Эльфийский смали (Elfiyskiy Smali)

Platform: hackerlab | Category: Reversing | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2025-12-27 | Status: Solved Techniques: Android Dalvik VM understanding, Smali bytecode analysis, XOR decryption with single-byte key

Summary

Task: Analyze smali files from an Android APK to find the flag. Solution: Identified XOR encryption in byteArrayToString function with key=7, extracted encrypted byte array from smali code, and decrypted it.

Эльфийский смали (Elfiyskiy Smali) - HackerLab

Description

Эльфы создлали своё приложение под зелёного робота. Я смог разобрать его, но докопаться до сути - нет. Но точно одно: разобранный вариант - это какой-то смали. Хоть и всё на эльфийском.

Category: Reverse
Difficulty: Medium
Points: 500

Analysis

Understanding the Name

The task name is a wordplay:

• "Эльфийский" (elvish) - a hint at the ELF format (Executable and Linkable Format)
• "Смали" (Smali) - assembly language for Dalvik VM (Android) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

However, in this case it's an Android application, not an ELF binary.

File Investigation

The task.zip archive contains 6 smali files - disassembled bytecode of an Android application written in Kotlin:

MainActivityKt.smali
ComposableSingletons$MainActivityKt.smali
ComposableSingletons$MainActivityKt$lambda-1$1.smali
ComposableSingletons$MainActivityKt$lambda-2$1.smali
MainActivity.smali
MainActivityKt$main$1.smali

MainActivityKt.smali Analysis

In the MainActivityKt.smali file, the byteArrayToString function was found: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 smali read-only • copy allowed Copy
.method public static final byteArrayToString([BI)Ljava/lang/String;
    .locals 5
    .param p0, "byteArray"    # [B
    .param p1, "key"    # I
    .annotation runtime Lkotlin/jvm/JvmOverloads;
    .end annotation

    # XOR each byte with the key
    xor-int v3, v2, p1    # v3 = byte XOR key
    int-to-char v3, v3

The function takes a byte array and a key (default = 7), then XORs each byte with the key.

Finding Encrypted Data

In the ComposableSingletons$MainActivityKt$lambda-1$1.smali file (lines 248-280), a byte array was found: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 smali read-only • copy allowed Copy
const/16 v3, 0x44    # 'D' XOR 7 = 'C'
const/16 v3, 0x48    # 'H' XOR 7 = 'O'
const/16 v3, 0x43    # 'C' XOR 7 = 'D'
const/16 v3, 0x42    # 'B' XOR 7 = 'E'
const/16 v3, 0x45    # 'E' XOR 7 = 'B'
const/16 v3, 0x5e    # '^' XOR 7 = 'Y'
const/16 v3, 0x7c    # '|' XOR 7 = '{'
...

Full array:

[0x44, 0x48, 0x43, 0x42, 0x45, 0x5e, 0x7c, 0x74, 0x6a, 0x47, 
 0x6b, 0x6e, 0x58, 0x64, 0x37, 0x63, 0x42, 0x58, 0x61, 0x37, 
 0x55, 0x58, 0x66, 0x69, 0x43, 0x75, 0x37, 0x6e, 0x63, 0x7a]

Solution

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

XOR Decryption

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Elfiyskiy Smali - XOR decryption
"""

encrypted = [
    0x44, 0x48, 0x43, 0x42, 0x45, 0x5e, 0x7c, 0x74, 0x6a, 0x47,
    0x6b, 0x6e, 0x58, 0x64, 0x37, 0x63, 0x42, 0x58, 0x61, 0x37,
    0x55, 0x58, 0x66, 0x69, 0x43, 0x75, 0x37, 0x6e, 0x63, 0x7a
]

key = 7  # Default key from byteArrayToString function

# XOR each byte with key
decrypted = ''.join(chr(b ^ key) for b in encrypted)
print(f"Flag: {decrypted}")

Output

Flag: CODEBY{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Notes

Smali Format

Smali is a human-readable representation of Dalvik bytecode:

• Created by tools like apktool, baksmali
• Each .smali file corresponds to one Java/Kotlin class
• Instructions are similar to assembly, but for a virtual machine

Typical Patterns in Smali

 smali read-only • copy allowed Copy
const/16 v0, 0x44     # Load constant into register
xor-int v1, v0, v2    # XOR two registers
int-to-char v1, v1    # Convert int to char

Tools for Working with Smali

• apktool - decompile APK to smali
• jadx - decompile to Java (more readable)
• baksmali/smali - Dalvik disassembler/assembler ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍